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We study a general quantum key distribution protocol in higher dimension. In this protocol, quantum states in 
arbitrary <? + l(l<<?<d) out of all d + 1 mutually unbiased bases in a d-dimensional system can be used for 
the key encoding. This provides a natural generalization of the quantum key distribution in higher dimension 
and recovers the previously known results for g — 1 and d. In our investigation, we study Eve's attack by 
two slightly different approaches. One is considering the optimal doner for Eve, and the other, defined as the 
optimal attack, is maximizing Eve's information. We derive results for both approaches and show the deviation 
of the optimal doner from the optimal attack. With our systematic investigation of the quantum key distribution 
protocols in higher dimension, one may balance the security gain and the implementation cost by changing the 
number of bases in the key encoding. As a side product, we also prove the equivalency between the optimal 
phase covariant quantum cloning machine and the optimal doner for the g = d — 1 quantum key distribution. 

PACS numbers: 03.67.Dd, 03.65.Aa, 03.67.Ac, 03.65.Ta 
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I. INTRODUCTION 

Quantum key distribution (QKD) is a promising applica- 
tion of quantum mechanics. The first QKD protocol was pro- 
posed by Bennett and Brassard in 1984 (BB84) fl] and has 
been proved to be unconditionally secure J^yL This protocol 
was later generalized to the six-state protocol |4]. Meanwhile, 
various other protocols were developed, among which, for ex- 
ample, was the Ekert 91 protocol @]. In the past decades, 
significant progress has been made both theoretically and ex- 
perimentally in establishing point-to-point as well as network 
types of key distributions; see, for example, Refs. jq- Ulll . 

In a simple two dimensional system, one can either use four 
quantum states or six quantum states, which correspond to the 
BB84 protocol and the six-state protocol respectively, to en- 
code binary symbols. In a higher-dimensional system of di- 
mension d IU2I1 . there are altogether d + 1 mutually unbiased 
bases (MUBs) available for the QKD. The counterparts of the 
BB84 protocol and the six-state protocol of a d-dimensional 
system are the 2-basis protocol and the (d+ l)-basis protocol. 
Naturally, one may think of a general (g + 1) -basis protocol 
(<7 = 1, 2, ... , d), where arbitrary g + 1 MUBs are utilized to 
encode d-ary symbols. In the past few years, there have been 
many studies on higher-dimensional QKD protocols. The 
QKD using four-level systems were done first jl3l U4I1. and 
interests soon extended to the d-dimensional case lfl5l423ll . 
Most of these studies, however, focused on the 2-basis and 
the (d + 1) -basis cases, and the research on the most general 
case is still absent. In this article, we present the study on such 
a general (g + 1) -basis QKD protocol. 

In principle, the quantum states of a higher dimension can 
be encoded in a continuous variable system such as a har- 
monic oscillator [24]. It is of fundamental interest, theoret- 
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ically, how a (g + 1) -basis QKD protocol is formalized. Our 
investigation of the (g + 1) -basis protocol is a natural gener- 
alization of the previously studied cases. The results of our 
systematic study may help one balance the security gain and 
the implementation cost by changing the choice of g. 

In this article, our general QKD protocol that uses arbitrary 
3+1 MUBs is the following. Suppose Alice, the sender, wants 
to send Bob, the receiver, a set of classical symbols consisting 
of 0, 1, d — 1. To start, Alice encodes every symbol, say i, 
into a pure quantum state |i) or \i( k >) of one randomly chosen 
MUB out of the g+ 1 and sends the state to Bob. Upon receipt, 
Bob measures the state using again a randomly chosen basis, 
which is correct with probability l/(g + 1). Subsequently, 
the choice of bases are publicly announced by Alice, and the 
states measured in bases different from they are prepared are 
discarded by the two parties. In the absence of any eaves- 
dropping and environmental noises, Alice and Bob are then 
left with identical strings of symbols while they are left with 
partially correlated strings in the presence of Eve, an eaves- 
dropper. By checking the agreement of a subset of the symbol 
sequence, Alice and Bob can decide whether to continue or 
abort the protocol. If the disagreement is below a threshold, 
they then perform a direct reconciliation and a privacy amplifi- 
cation to obtain a set of shared key. In this article, we consider 
that Eve attacks the QKD by intercepting and cloning the state 
being sent to Bob. For simplicity, we think of that Eve uses a 
fixed and balanced (balanced between different bases) cloning 
transformation for each qudit, and that Eve measures her state 
before the one-way post-processing between Alice and Bob. 

In this article, we investigate Eve's attack scheme by two 
slightly different approaches, both starting from a general 
form of cloning transformation proposed in Ref. 12511 . One 
approach is considering the optimal doner for Eve where we 
maximize the fidelities of the state of Eve. The other is consid- 
ering maximizing the information Eve has about Alice's state, 
which, rather than maximizing the fidelities, is defined as the 
optimal attack. We do these separately in Sec. |II]and Sec. [IV] 
and compare the two approaches subsequently. As we shall 
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see, they give different results. The second approach is done 
in a somewhat restrictive sense, but it is sufficient to prove the 
difference between the optimal doner and the optimal attack. 
Sec. |nl]gives some analytical solutions to the optimal doner 
in special cases, including the symmetric doner correspond- 
ing to a general g. In Sec. [V] we introduce a side product of 
our first approach to the QKD attack, where we present the 
link between a QKD doner and a revised asymmetric form of 
the optimal symmetric phase covariant quantum cloning ma- 
chine proposed in Ref. M26I1 and prove the optimality of the 
latter. In Sec. [VI] we end the article by a brief conclusion. 



II. THE OPTIMAL CLONER OF EVE 

Now we investigate the optimal doner that Eve can use. 
Before proceeding, let us first introduce some notations. In 
dimension d, there are d + 1 mutually unbiased bases, namely 
{\i}} and (k — 0, 1, ... , d — 1), which more explic- 

itly are 



Vd 



d-l 



(i) 



+ (d — 1) and ui = e l2 z~ l27ll . By saying 
two bases, say {l^ -*)} and {l^ 1 -*)}, are mutually unbiased, 



with Sj = j 



we mean 



that |(i«|jfe(°>)| 



l 

Vd 



for any and in 



the two bases respectively. The generalized Pauli matrices a x 
and <j z act on the states so that a x \j) = \j + 1) and cr 2 |j) = 
up \j) . Throughout the article, we omit the "modulo d," which 
is the case here. We define U mn = cr^a™ so that U mn \j) = 
tjjjn | j _|_ m ^ p ma rj Vi the generalized <i-dimensional Bell states 
read 



with to, n = 0, 1, 



= (I® f7 m _„)|$oo) 
d — 1 and 

d-l 

i*oo} = -=ei^>- 



(2) 



(3) 



Now, we consider the optimal doner for Eve. Suppose a 
state \iP)a is sent by Alice and intercepted by Eve. Then, Eve 
prepares a maximally entangled state |<f>oo) E'E and performs 
a unitary transformation U of the general form proposed in 
Ref. S: 



d-l 



U = a mn {U, 



U„ 



<8>I). 



(4) 



m,n— 



Here, a mn are the parameters of the unitary transformation, 
satisfying J2 m n \ a mn\ 2 = 1- This transformation yields 

U\iP) a \$oo)e'e 

= ^ a mnU mn \lp)B ® \®-m,n)E'E (5a) 
= ^ b mn\®-rn,n)BE> ® U mn \lp) E , (5b) 



where A, B, E and E 1 denote Alice, Bob, Eve and her cloning 
machine respectively. b mn are the discrete fourier transform 
of a mn , i.e. b mn = \ J2k, r ak r u kn ~ rm . Eqs. (Ho} and $5B 
make it convenient to write down the density matrices of Bob 
as well as Eve. For \iP)a being state \i) or \i( k ^) of each MUB, 
we have 



PB 



~(fc) 
Pb 



Pe 



~(fc) 
Pe 



E 

m,n— 
d-l 

E 

i,n= 
d-l 

E i fe 

i,n— 
d-l 

E i fe 



m,n— 
d-l 



mn| 2 K + rn)(i + to|, (6a) 

m n| 2 (C/ m nN (fe) )B)((« (fe) |i3C/i„), (6b) 

2 \i + m)(i + m\, (6c) 

2 (f/„ m |? fe) ) £ )((* (fc) | S f/ r L„) (6rf) 
(fc = 0, 1, ... , .9-1). 



Let us consider the fidelities of the states B and E with 
respect to all the g + 1 different bases. The fidelity here can 
be defined as F = (i^\p°^ f d \ip), the value of which differs for 
states of different bases. With the help of the properties of the 
Pauli matrices and the Bell states, we figure out the fidelities 
of B and E for each mutually unbiased basis: 



F B = 



t B 



I a 0n| 2 , 



*"m,km\ : 



E 

n 

El- 

m 

m n 
n m 

(k = 0, 1, 



2 

mn | i 



m,n-\-km \ 



(7a) 

(lb) 

(7c) 
(Id) 



For the QKD using g + 1 MUBs, without loss of general- 
ity, we suppose that the bases {\i}}, {|i (0) )}, {|« (9_1) )} 
are chosen by the two legitimate parties. For simplicity, we 
assume that Eve's attack is balanced, i.e. she induces an equal 
probability of error for all the g + 1 MUBs. This assumption 
follows from the reasoning that Eve can be detected easily by 
unbalanced disturbance otherwise, and that, as we find, Eve 
cannot maximize all her g + 1 fidelities simultaneously if the 
disturbance is unbalanced. Hence, we assume 



rp _ p(o) _ 
?b- £ B - 



= F, 



(9-1) 



(8) 



At this point, to obtain an optimal doner, Eve has to maximize 
her fidelities for a given Fb, which quantifies the disturbance. 
We claim and will show later that Eve can maximize all her 
g+ 1 fidelities simultaneously and that they are equal. We start 
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by a "vectorization" of the matrix elements of (a mn ). Let 

d* = {ai,u,-,a<i-i,(d-i)i) (* = 0, ... , .9 - 1), (9) 
A = (A u ... ,A d _,), (10) 

d-l 

A: = Yl a V ( l = - !)• (11) 

j#0,i,...,(g-l)i 

The rest elements are a^j (j = 0, ... ,d — 1). Eq. (© gives 
the following restrictions: 

d-l 

J2\ a oj\ 2 =F B - |aoo| 2 , (12) 

3=1 

M^ll 2 = ^ S — |« 00 | 2 (i = 0,...,g-l). (13) 
One of Eve's fidelity F B now reads 

^ = 3(iX>ii 3 + iiE*+^li 2 )- (1 4 ) 

Eqs. (fT2l-([T4l> tell us how the fidelities of Eve and Bob are 
coupled with each other. 

Now we show how Eqs. d9l-(fl4]i work by doing the g = 2 
version of them. The results for a generic g can be obtained 
analogously. For g — 2, 

^ d-l 

Fe = ^(lE a °j| 2 + ll^o + ai +A|| 2 ), 



d-l 

E l a °J'l 
3 = 1 



|ai|| = i^s — |a o| 



We tentatively fix the values of |aoo| and A. By vector ma- 
nipulation, it is easy to find that the maximum Fe is achieved 
when 



do, q?i oc A, 

OOl = •■• = «0,d-l 



Fb - |a 00 | 2 
d-l ' 



,iArg(a 00 ) 



Unfixing |aoo| and A, Fe becomes a function of them and is 
positively correlated to \ \A\ \ directly. Using the normalization 
condition ^ mn |a m „| 2 = 1, we find that ||A|| is maximal 
when a it 2i = o i)3i = ... = ai^d-i)i (i = 1, — , d - 1). Now 
we visualize the matrix (a mn ): 



{a,, 



/ V X X X 

xi xi yi yi 

x 2 V2 x 2 ?/2 

2^3 V3 V3 X 3 

V : ; : : 



where 



F B ~ H 2 iA rg(v) 

d-l 

At 

m 1 y 



Ai 



d-2' 



Correspondingly, Eve's fidelity Fe becomes 



F E = ±[(\v\ + V(d-l)(F B -\v\i)f 



+ (VI + 2|«| 2 - 3F B + 2^F B - |«P) 2 ]. 

Thus far, we have maximized one of Eve's fidelities. The other 
fidelities can be obtained simply by transposing the roles of 
"the horizontal direction," "the vertical direction," and "the 
diagonal direction" of the matrix (a mn ) and redefining do, 
di, and A accordingly. Doing so, we find that the condition 
for optimization of all Eve's fidelities, with an overall phase 
omitted, is 
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where the elements are all real, and 



'F B -v 2 _ l + 2v 2 -3F B 
' ~ W d-l ' V -\ (d-l)(d-2)" 

All Eve's fidelities are found to be equal. They are equal to 

F E = \{\v + (d- l)x} 2 + (d- l)[2x +(d- 2)y} 2 }. 
d 

The results for a generic g are analogous to those for g = 2. 
The difference is that some "2" are substituted by "g." We thus 
present the following optimization condition and the optimal 
Eve's fidelities: 

E r e ~ ■•• E ~ 

- d {[v + (d- l)x} 2 + (d- l)[gx + (d - g)y} 2 }, (15) 

{v, m = n = 0, 
x, m = 0,n^0orm^0,n = km, (16) 
y, otherwise 
(k = 0, ... , g — 1), for some v, 

where 



d-l 



'l+gv 2 -(g + l)F E 
(d-l)(d-g) 



(17) 



| = V1 + 2M 2 -3F B . 



One notices that there is still an undetermined, independent 
variable v. To achieve the maximal F B for a given F B , one 
needs to further optimize the value of v. In some cases, this 
can be done analytically, but, in the general case, there seems 
to be no evident analytical expression. Those analytical re- 
sults are presented in Sec. III. We do numerical calculation 
for the general case. 

To show the performance of the optimal doner, we choose 
d = 5 as an example and plot the optimized F B and v curves 
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FIG. 1: (color online). The curves of the fidelity Fe (dashed blue 
lines) and the parameter v (solid red lines) as functions of Fb of 
the optimal doner for d — 5 and g = 1, 2, 5. The g = 1 and 
g — 5 lines are derived from Eqs. dl9t and d21t respectively. The 
curves for general g's are numerically computed from Eqs. (Q3)- 
(JTTJ. The general-;; curves in some domains with very small Fb 
are incomputable by Eqs. d 1 5 fc-d 1 Vb, but they can be obtained by 
exchanging the roles of E and B. 



as functions of Fb in FIG. [TJ The figure shows that, as Fb 
increases, Fe decreases, i.e. as the disturbance decreases, the 
state E resembles the original state less. The figure also shows 
reasonable shifts of the curves as g varies. As g increases, i.e. 
as more bases are used, the Fe curve shifts down, suggest- 
ing that Fe is lower for a given Fb ■ The difference between 
adjacent curves is small for large g's. 



III. ANALYTICAL SOLUTIONS TO THE OPTIMAL 
CLONER 

In this section, we present the analytical expressions of Fe 
and v for some special cases. The first one is the g = 1 case. 
For g = 1, an easier method gives that 



v = F B , x 

W'tlClK'C 

1 , 



F B (1-F E 



l-F E 



F E = jlVFB + V(d-l)(l-FB)} 2 - 



(18) 



(19) 



The second set of analytical results is for g = d. In this case, 
there exists no y in the matrix (a mn ), and v has a fixed value 
given below. 



(d + 1)F B - 1 



/ 1- F B 
d(d- 1) 



(20) 



whence 

1 

F E = -=7 



d? 
{1-Fb 



y/(d + 1)F B -l + y/(d- 1)(1 - F B ) 



(21) 



Eqs. ( fT9l and ( |2"TT i recover the previous known results in Ref. 
01511 . Here, they are related by parameters v and g within a 
unified framework. 

The third case in which we have analytical results is that 
Eve and Bob have equal fidelities, i.e. Fe = Fb = F. We 
start by observing the following fact: When Fb = Fe = F, 
Eq. ( TT3T > is equivalent to 

^{d-g)[l + gv*-{g + l)F} 



>y/d-l- {g+l)\/F -v 2 . (22) 



We square this equation and let u = \/F — v 2 , and we end up 
with an quadratic equation of u and v, 



(d +!)(<?+!) 



2d - g - 1 



2(.g+l)V^T 



-uv 



1, (23) 



which represents an ellipse centering at the origin. The fidelity 
F = u 2 +v 2 is the square of the distance from the origin to the 
point (it, v) and is thus maximal at one end of the major axis. 
It is easy to find that point by diagonalizing the coefficient 
matrix. The eigenvalues of that coefficient matrix are found 
to be 



d 



2{d-g) 



where 



A, 



P(d,g) = J ( 5 + 3) 2 



[(g + 3)±P(d,g)}, 



, (d -<?)(<? +1) 



(24) 



(25) 



By further calculating the eigenvectors, we figure out the max- 
imal fidelity F and the corresponding parameter v. The max- 
imal fidelity is 

p __ J_ _ 2 d-g 

X _ d(g + 3)-P(d,g)' 



2 

d' 



9 



(ff + 3)- v /(, 9 + 3)2-8 (d - g) i 9+1) 
The corresponding v satisfies 

(d+l)(g + l)-(d-g)X+ 



u 

v 



-(g+l)Vd=l 



(26) 



(27) 



and is thus 

r 2 



(d -!)(«*- g) 
[ d (g + 3)~P(d,g) 
1 



(d-l) + [^P(d,g) 



- 1 - 



d g-l ]2 J 
2 3+1 J 



(28) 
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We remark that Eqs. ( I26l l and ( 1281 ) are the results for an op- 
timal symmetric cloning machine that clones arbitrary g + 1 
MUBs and that has not been studied. We can find that, as g 
increase, F increases as it is expected. 



IV. THE OPTIMAL ATTACK OF EVE 



As mentioned above, Iae is between the random variable A 
and the random variable pair (£", E). Suppose (£", E) takes 
the value (e', e). Eq. (l33l l tells us that it is equivalent to rep- 
resent (e', e) by (m, e'). Thus, Eve's information Iae can be 
written as 



Iae = - ^2p(m,e')\og 2 p(m,e') 



In our 9+1 basis QKD protocol, we consider that Eve in- 
tercepts each state and copies it using a fixed cloning machine 
of the form of Eq. ©. We now think of that Eve's scheme 
is to maximizes her information about the state, rather than 
the fidelity, for a given, balanced disturbance. We consider 
that the post-processing between Alice and Bob is one-way, 
consisting of a direct reconciliation and a privacy amplifica- 
tion. Therefore, the amount of secret information extractable 
by Alice and Bob reads 



r = Iab - Iae , 



(29) 



where Iab ( or Iae) is the mutual information between the 
two classical strings of symbols of Alice and Bob (or of Alice 
and Eve). Note that Eve can measure E 1 and E jointly, so 
Iae represents the mutual information between the classical 
random variable A and the random variable pair E' and E, 
which is Eve's joint-measurement outcome (for convenience, 
we denote the associated random variables again by A, B, E', 
and E). 

Let us now see what restrictions are imposed on Eve. 
We supposed that Eve's attack is balanced between different 
bases, i.e. the fidelities of Bob's state are same for different 
MUBs. Here, for similar reasons, we also suppose that, for 
each basis, the probabilities that Bob make different errors 
are equal (one can check that this restriction is compatible 
with the results in Sec. |IIJ. Say the error Bob makes is m 
(m = 0, 1, ... , d — 1), i.e. Bob's symbol is greater than 
Alice's symbol by m. Then, from Eqs. (|6o1>-(|62/1>. we find the 
following explicit expressions for these restrictions: 



d-l 



Y^i ,2 _ ) f b, m = 0, 



3=0 



d-l 



1 2 I Fb, m = 0, 

{k = 0, 1, ... , . 9 -l). 



(30) 
(31) 



Under these restrictions, one can easily find that the mutual 
information between Bob and Alice is given by 

Iab = log 2 d + F B log 2 F B + (1 - F B ) log 2 ■ (32) 

To find Iae for one basis {\i)}, we first rewrite Eq. ( T5ab as 



Wa 



+ ^2 M a M m ' e 'l a ) l0 S2?3( m : e 'l a )- (34) 

a is the value the random variable A takes. We assume that 
Alice sends symbols randomly. Thus, in Eq. ( T34l i. p(a) = 
4. The other terms in Eq. ( 1341 are given below, as they are 
derived from Eq. fl33l >. 



p(m,e'\a) = ^l^ " 

n 

p(m, e') = — y^^(m, e'\ 

n — ' 



z(a-e') |2 



(35) 



(36) 



The expressions for Iae °f tne other bases can be writ- 
ten analogously. Most generically, the optimal attack can be 
found by maximizing the Iae's under the restrictions of Eqs. 
(T30b and (fJTJ. This can be done in principle, but it is hard 
because of the great number of variables and summations. 
Hence, instead, we here maximize Eve's information condi- 
tionally: We suppose that the matrix (a mn ) takes the form 
of Eq. ( TToT ) but that v is adjustable to maximize Eve's infor- 
mation (rather than Eve's fidelities). One can check that Eq. 
( TToT ) satisfies Eqs. (f30b and OTb . and one need only calculate 
Iae with respect to one basis because Eq. ( TToT l is balanced be- 
tween different bases. We shall compare the results with those 
of the optimal doner approach later. In this more restrictive 
case, a mn are given partial freedom, but as we shall see, this 
is sufficient to prove the deviation of the optimal attack from 
the optimal doner. 

We refer to Eq. ( TToT ) and find that Eq. d35l ) now reads 



p(m, e'\a) - 

( [v+(d-l)x] 
d 

(v-x) 2 



m = 0, e' = a, 
m = 0, e' 7^ a, 
77i ^ 0, e' = a, 
, ^-\ 2 , to^O, e' = a-t (^0). 



d ' 

[gx+(d-g)y? 

d ' 
(x-y) 2 | 1-Lj m9t |2 
d 



(37) 



(33) 



Then, numerical calculation can be easily done by adjusting 
v to maximize Iae, and both Iab and Tab become functions 
of Fb- Let us focus on the critical point where the amount 
of extractable information is zero, i.e., according to Eq. ( |29l , 
Iab = Iae- As usual, we substitute Fb with Di, the dis- 
turbance, defined as Dj = 1 — F B . We compute the Dj's 
associated with zero extractable information for several d's 
and list them in TABLE U The values of these critical D/'s 
show regular behaviors: As d or g increases, Dj increases, 
i.e. as more bases are used, higher disturbance is acceptable 
for Alice and Bob. 
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Di{%) 


9 


1 


2 


3 


4 


5 


6 


7 




2 


14.64 


15.64 














3 


21.13 


22.47 


22.67 










d 


5 


27.60 


28.91 


29.12 


29.20 


29.23 








7 


30.90 


32.10 


32.26 


32.32 


32.36 


32.38 


32.39 



TABLE I: The disturbance Di associated with zero extractable in- 
formation for Alice and Bob. These values are obtained with condi- 
tionally maximized Iae, where (a mn ) is restricted to the form of Eq. 
l !16b . For the d's and g's we consider, Di shows regular behaviors: 
Both when d increases and when g increases, Di increases. Since 
the unconditionally maximized Iae can be slightly higher, the real 
critical Di can be slightly lower than the values here. 



It is interesting to see whether the maximizing information 
approach and the maximizing fidelity approach are equiva- 
lent. For definiteness, let us consider whether the optimal 
doner corresponds to the maximal Iae- We substitute the 
a mn in Eqs. (I34li-(l36l> by the values associated with the opti- 
mal doner. This means that we plug into Eq. (|37| > the value 
of v of the optimal doner, as is calculated in Sec. [XT] Then, 
we similarly end up with a table (TABLE Hill of the distur- 
bance associated with zero extractable information. We use a 
different notation Dp here to indicate that it corresponds to 
the maximized Fp rather than the maximized Iae- In TA- 
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F (%) 
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1 


2 


3 


4 


5 


6 


7 




2 


14.64 


15.64 














3 


21.13 


22.99 


22.67 










d 


5 


27.64 


29.75 


29.83 


29.63 


29.23 








7 


31.10 


33.24 


33.16 


33.00 


32.83 


32.64 


32.39 



TABLE II: The disturbance Df associated with zero extractable 
information, obtained simply by plugging the values of amn of the 
optimal doner into Eqs. J34M36) . Df has an irregular behavior: As 
g increases, Df does not change monotonously. Df deviates above 
Di of TABLE U except for g — d, in which case v is fixed, and the 
higher the dimension, the larger the deviation. This suggests that the 
optimal doner is not the optimal attack (see the text). 



BLE|n] Dp shows an irregular behavior: As g increases, i.e. 
as more bases are used, D p does not always increase. Dp is 
greater than Dj except for g = d, in which case v is fixed, and 
the deviation tends to be larger as d increases. As we know, 
associated with Dj is the Iae that is maximized under the 
condition that (a mn ) is of the form Eq. ( fl6l ). so the maximal 
Iae free of this condition may be slightly larger and thus the 
condition-free Dj may be lower. Since Dp is larger than the 
conditional Dj, it is larger than the condition-free Dj. There- 
fore, maximizing Fp is not equivalent to maximizing Iae, 
and the optimal doner does not correspond to the optimal at- 
tack. 



V. PHASE COVARIANT QUANTUM CLONING MACHINE 

We now introduce a side product of the optimal doner ap- 
proach to our g + 1 protocol QKD. As mentioned in Ref. 1151 . 
the optimal doner for d + 1 MUBs (g = d) is the universal 
quantum cloning machine Ip25il28ll . For d MUBs (g = d — 1), 
one may intuitively think of phase-covariant quantum cloning 
machine. In this section, we show that the optimal doner 
of d MUBs is equivalent to the optimal asymmetric phase- 
covariant quantum cloning machine. More specifically, we 
show that it is equivalent to a revised asymmetric form of the 
symmetric phase-covariant quantum qudit cloning machine 
presented in Ref. |p26ll . and we prove the optimality of that 
revised form. 

In Ref. ll26tl . the following equatorial states are considered: 



'Ij>, 



(38) 



where tfij are arbitrary phase parameters. (Thus, the corre- 
sponding MUB cloning machine should be the one that clones 
the bases {|i' ')}, and The explicit expression 

for the symmetric cloning transformation is given as 



a\ii)i2\i}R - 



P 



V2(d-1) 



=?£(|y) + |ji))li>, (39) 

> 3& 



where 1, 2 represent the two clones while R is the ancillary 
state, a and are real parameters that satisfy a 2 + (3 2 = 1. 
The optimal fidelity for the symmetric cloning machine reads 

1 



F 



optimal 



= — {d + 2 + ^d?+Ad-A). 



(40) 



One finds that Eq. ( f4Qb is consistent with Eq. 

Now we claim that the optimal asymmetric phase-covariant 
quantum cloning machine is equivalent to the optimal doner 
of the d MUBs and takes the form 



|i) -> a\ii)\i) + 



P 



yfd^l^. 



(cose\ij)+sm6\ji))\j),(41) 



where 9 is a real parameter. To prove this claim, we first write 
down the fidelities associated with this cloning transforma- 
tion, 



1 
d 
1 

d 



2a(3 
~d~ 

2a/3 



Vrf — 1 cos 9 



V d — 1 sin 9 



P 2 (d-2) 
d 

P\d~2) 



(42) 



sin 2 (9, (43) 



where the constraint a 2 + f3 2 — 1 still holds. We per- 
form a numerical calculation that manipulates a, (5, as well 
as 9 to maximize one fidelity given the other. The results 
show that the optimized fidelities for this asymmetric phase- 
covariant cloning quantum machine are equal to the fidelities 
of the optimal d-MUB doner, as are computed in Sec. [XT] 
Since cloning equatorial states has a higher requirement than 
cloning d MUBs, the optimality of a <i-MUB doner infers the 
optimality of an asymmetric phase-covariant quantum cloning 
machine with the same achieved fidelities, and their equiva- 
lency. This proves our claim. 
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VI. CONCLUSION 

In this article, we study the general, d-dimensional QKD 
that uses arbitrary g + 1 MUBs, focusing on the individual at- 
tack by Eve and the one-way post-processing (a direct recon- 
ciliation plus a privacy amplification) by Alice and Bob. This 
investigation of the general g + 1 MUB QKD protocol is a nat- 
ural generalization of the QKD in higher dimension and may 
help one balance the gain and the cost of the implementation. 
In this article, we investigate Eve's attack by two different ap- 
proaches. One is maximizing Fb, the fidelity of Eve's state 
E, while the other is maximizing Iae, the information Eve 
has about Alice classical symbol. In the first approach (Sec. 
Hil l, we derive the fidelities and the parameter of the optimal 
doner and demonstrate their behaviors, which are reasonable. 
It turns out that in some special cases, the most significant 
of which is the symmetric cloning, the optimal doner can by 
solved analytically (Sec. [TTTb - In the second approach (Sec. 
llVb . we give the equations for the most generic calculation 
for Iae maximization, but, considering its complexity, we do 
instead a more restrictive version. Though restricted, the cal- 



culation still shows interesting results. In particular, it proves 
(except for g — d) the deviation of the optimal doner from 
the optimal attack. Sec. |V] is dedicated to a side product of 
our optimal doner approach. We show that the optimal asym- 
metric phase covariant quantum cloning machine is equivalent 
to the optimal doner of d MUBs (g = d — 1). We also show 
that this optimal asymmetric phase covariant quantum cloning 
machine can be formulated as a revised version of the optimal 
symmetric cloning transformation presented in Ref . M26I1 . As 
the bottom line, we here remark that there still exist several 
possible extensions, which may be of future interests, for our 
general, (g + l)-basis, qudit-based QKD protocol: extension 
to two-way post-processing, to prime-power dimensional sys- 
tems, and to the coherent attack. 
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